← All changes | app/Models/User.php +20 -0 1.4.1 → 1.6.5 View file →

		@@ -17,8 +17,28 @@
17	17	protected $primaryKey = 'ID';
18	18
19	19	protected $guarded = ['password'];
20	20
	21	+ /**
	22	+ * Credential columns of the WordPress `users` table that must never be
	23	+ * serialized into an API response.
	24	+ *
	25	+ * `$guarded` above is mass-assignment protection only (GuardsAttributes) and
	26	+ * has no effect on serialization — and it names `password`, which is not even
	27	+ * a real column. Serialization hiding lives here (HidesAttributes), and it is
	28	+ * applied by HasAttributes::getArrayableItems(), so it covers toArray(),
	29	+ * toJson() and every `with('wpUser')` eager load at once.
	30	+ *
	31	+ * This affects serialization ONLY. Direct property access ($user->user_pass)
	32	+ * still works, so internal reads are unaffected.
	33	+ *
	34	+ * @var array
	35	+ */
	36	+ protected $hidden = [
	37	+ 'user_pass', // bcrypt/phpass password hash
	38	+ 'user_activation_key', // password-reset / new-user activation token
	39	+ ];
	40	+
21	41
22	42	/**
23	43	* Check if the user has a specific permission.
24	44	* @param string|array $permission